Skip to content

pySCG: Adding explanation of the 'is' operator to CWE-595 #997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

pySCG: Adding explanation of the 'is' operator to CWE-595 #997

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8c18703
pySCG: Adding explanation of the 'is' operator to CWE-595
s19110 Sep 26, 2025
d0e7050
CWE-595: Added code example for string interning and integer caching
s19110 Oct 3, 2025
551425b
Fix markdown linter errors
s19110 Oct 3, 2025
a307c58
Update docs/Secure-Coding-Guide-for-Python/CWE-697/CWE-595/README.md
s19110 Oct 3, 2025
cd70645
Markdown linter fixes for the suggestion
s19110 Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 26 additions & 8 deletions docs/Secure-Coding-Guide-for-Python/CWE-697/CWE-595/README.md
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggstion for first sentence:

Prevent unexpected results by knowing what comparisment operators do such as == and is actually do.

After the existing first sentence we shall also explain:

Python falls back to comparing objects id() if the `eq implementation is missing for a custom class.

Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ You want to implement the `__eq__` method on a class if you believe you ever wan

Copy link
Contributor

@myteron myteron Oct 1, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Be aware of Python's memory optimization for strings and numbers as demonstrated in example01.py code.
Python tries to avoid allocating more memory for the same string. Numbers -5 to 256 are so frequently used that they are pre-reserved.

# SPDX-FileCopyrightText: OpenSSF project contributors
# SPDX-License-Identifier: MIT
""" Code Example """

print("-" * 10 + "Memory optimization with strings" + 10 * "-")
a = "foobar"
b = "foobar"
c = ''.join(["foo", "bar"])
print(f"a is b: {a} is {b}?", a is b)
print(f"a is c: {a} is {c}?", a is c)
print(f"a == c: {a} == {c}?", a == c)
print(f"size? len(a)={len(a)} len(b)={len(b)} len(c)={len(c)}")

print("-" * 10 + "Memory optimization with numbers" + 10 * "-")
a = b = 256 
print (f"{a} is {b}?", a is b)
a = b = 257
print (f"{a} is {b}?", a is b)

print("-" * 10 + "Memory optimization with numbers in a loop" + 10 * "-")
a = b = 255
while(a is b):
    a += 1 
    b += 1
    print (f"{a} is {b}?", a is b)

The example01.py code output:

a is b: foobar is foobar? True
a is c: foobar is foobar? False
a == c: foobar == foobar? True
size? len(a)=6 len(b)=6 len(c)=6
----------Memory optimisation with numbers----------
256 is 256? True
257 is 257? True
----------Memory optimisation with numbers in a loop----------
256 is 256? True
257 is 257? False

The first print statement illustrates Python's memory optimization for strings.
See id(a) and id(b) printing the same object number compared to id{c} printing a different id for t he same string.

The example in the middle creates same object number as a = b = 257 tells python that it can used the same memory.

The last print statements in example01.py illustrate Python's memory optimization for numbers between -5 to 256. Python needs to allocate new objects for numbers greater then 256. Note that the behavior of Python for numbers between -5 and 256 change depending on how its run. Following code changes behavior when run via interactive Python shell or in a file:

example02.py:

a = 256
b = 256
print(a is b)
a = 257
b = 257
print(a is b)

Using an interactive Python shell will print True and False while running the code in a python script will print True and True as the runtime has optimized the code to preserve memory.

## Non-Compliant Code Example

The non-compliant code shows how the default comparison operator compares object references rather than the object values. Furthermore, it displays how this causes issues when comparing lists of objects, although it applies to other types of collections as well. Finally, it shows how the `in` operator also depends on the behavior of the `__eq__` method and, therefore, also returns a non-desirable result.
The non-compliant code shows how the default comparison operator compares object references rather than the object values. Furthermore, it displays how this causes issues when comparing lists of objects, although it applies to other types of collections as well. Then, it shows how the `in` operator also depends on the behavior of the `__eq__` method and, therefore, also returns a non-desirable result. Finally, it performs the comparison with the `is` operator, which checks as to whether the references point to the same object regardless of the stored value.

[*noncompliant01.py:*](noncompliant01.py)

Expand All @@ -27,41 +27,59 @@ print(Integer(12) == Integer(12))
print([Integer(12)] == [Integer(12)])
# And this is equally this will always be False as well
print(Integer(12) in [Integer(10), Integer(12)])
# The 'is' will return True only if both references point to the same object
a = Integer(12)
b = a
# Here, a and b point to the same Integer, so 'is' returns True
print(a is b)

b = Integer(12)
# Even though b still points to an Integer of the same value, it is a new object, so 'is' returns False
print(a is b)

```

## Compliant Solution

In this compliant solution the `__eq__` method is implemented and all the comparisons now correctly compares the object values, rather than the object reference.
In this compliant solution, the `__eq__` method is implemented and the comparisons that not use `is` now correctly compare the object values, rather than the object reference. The `is` operator does not call `__eq__`, hence the last print will still display `False`.

[*compliant01.py:*](compliant01.py)

```py
""" Compliant Code Example """


class Integer:
def __init__(self, value):
self.value = value

def __eq__(self, other):
if isinstance(other, type(self)):
return self.value == other.value
if isinstance(other, int):
return self.value == other
return False


#####################
# exploiting above code example
#####################
# All these scenarios will now show True
print(Integer(12) == Integer(12))
print([Integer(12)] == [Integer(12)])
print(Integer(12) in [Integer(10), Integer(12)])

# By adding the handling for int we also support
print(Integer(12) == 12)
# The 'is' will return True only if both references point to the same object
a = Integer(12)
b = a
# Here, a and b point to the same Integer, so 'is' returns True
print(a is b)

b = Integer(12)
# Since the 'is' operator does not call __eq__, print below will still return False
print(a is b)

```

Expand Down
21 changes: 15 additions & 6 deletions docs/Secure-Coding-Guide-for-Python/CWE-697/CWE-595/compliant01.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,27 +1,36 @@
# SPDX-FileCopyrightText: OpenSSF project contributors
# SPDX-License-Identifier: MIT
""" Compliant Code Example """


class Integer:
def __init__(self, value):
self.value = value

def __eq__(self, other):
if isinstance(other, type(self)):
return self.value == other.value
if isinstance(other, int):
return self.value == other
return False


#####################
# exploiting above code example
#####################
# All these scenarios will now show True
print(Integer(12) == Integer(12))
print([Integer(12)] == [Integer(12)])
print(Integer(12) in [Integer(10), Integer(12)])

# By adding the handling for int we also support
print(Integer(12) == 12)
# The 'is' will return True only if both references point to the same object
a = Integer(12)
b = a
# Here, a and b point to the same Integer, so 'is' returns True
print(a is b)

b = Integer(12)
# Since the 'is' operator does not call __eq__, print below will still return False
print(a is b)
9 changes: 9 additions & 0 deletions docs/Secure-Coding-Guide-for-Python/CWE-697/CWE-595/noncompliant01.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,12 @@ def __init__(self, value):
print([Integer(12)] == [Integer(12)])
# And this is equally this will always be False as well
print(Integer(12) in [Integer(10), Integer(12)])
# The 'is' will return True only if both references point to the same object
a = Integer(12)
b = a
# Here, a and b point to the same Integer, so 'is' returns True
print(a is b)

b = Integer(12)
# Even though b still points to an Integer of the same value, it is a new object, so 'is' returns False
print(a is b)